Move releases to GitHub, with one bridge release on Gitea

GitHub has no generic package registry, so releases become GitHub
release assets. The updater and install.sh read releases/latest/download
and releases/download/<v>/, plain redirects with no API rate limit.
make release publishes a draft with all assets, then makes it latest.
make release-gitea publishes the same version to the old Gitea registry
for binaries that still update from there, and refuses until GitHub
serves it. See D33.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/README.md

@@ -20,12 +20,12 @@ bare commit hash.
 ## Install
 
 ```sh
-curl -fsSL https://git.simon-franken.de/simonfranken/submarine/raw/branch/main/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/simonfranken/submarine/main/install.sh | sh
 ```
 
 Installs `submarine` and the alias `sub` (linux/macOS, amd64/arm64) to
 `~/.local/bin`. Update with `submarine update`. Maintainers publish with
-`GITEA_TOKEN=… make release` (see [architecture](architecture.md#distribution)).
+`make release NOTES=…` (see [architecture](architecture.md#distribution)).
 
 ## Status
 

docs/architecture.md

@@ -23,7 +23,7 @@ internal/submodule/git/       provider using the git CLI (reads, fetch, watch)
   switch.go                   Branches, SwitchLoss, Switch (stage the tip, restore, attach or fast-forward the branch)
   gitdir.go                   resolves .git dirs and gitdir: files
 internal/submodule/mock/      fixture provider with artificial latency
-internal/update/              self-update from the package registry; NO UI imports
+internal/update/              self-update from GitHub releases; NO UI imports
 internal/tui/                 Bubble Tea application
   app.go                      root model: layout, message routing, loading
   keys.go                     key bindings (also feed the help view)
@@ -203,17 +203,24 @@ No CI runner: releases are built and published from a developer machine.
 - `make dist` cross-compiles `CGO_ENABLED=0` binaries for linux/darwin ×
   amd64/arm64 into `dist/` plus `checksums.txt`; the version comes from
   `git describe` and is baked in with `-X main.version`.
-- `make release` with `GITEA_TOKEN` set, e.g. in `.env` (copy `.env.template`; token needs `write:package`; HEAD must be a
-  clean `vX.Y.Z` tag) runs tests, builds and uploads to the Gitea generic
-  registry `https://git.simon-franken.de/api/packages/simonfranken/generic`:
-  - `submarine/<version>/submarine_<os>_<arch>` and `checksums.txt`
-  - `submarine-latest/latest/VERSION`, replaced **last**, so a failed upload
-    never advertises a broken version.
+- `make release NOTES=FILE` (needs `gh` logged in, or `GH_TOKEN` in `.env`,
+  see `.env.template`; HEAD must be a clean `vX.Y.Z` tag pushed to GitHub)
+  runs tests, builds and creates the GitHub release `vX.Y.Z` with the notes
+  and the assets `submarine_<os>_<arch>`, `checksums.txt` and `VERSION`. It
+  is created as a **draft** and published last, so `releases/latest` never
+  points at a release with missing assets. Clients read, without the API
+  (plain redirects, no rate limit), below
+  `https://github.com/simonfranken/submarine/releases`:
+  - `latest/download/VERSION`
+  - `download/<version>/submarine_<os>_<arch>` and `checksums.txt`
+- Before the move to GitHub, releases lived in the Gitea generic registry
+  (`git.simon-franken.de/api/packages/simonfranken/generic`, see D33). It
+  stays online for old binaries. `make release-gitea` publishes the bridge
+  version there in the old layout and refuses until GitHub serves it.
 - The `release` skill (`.claude/skills/release/SKILL.md`) drives a release:
   latest tag → next semver from the commits since → check (`vet`, `test`,
   `gofmt`, `make dist`) → tag and push → the developer runs `make release` →
-  the skill verifies the registry's `VERSION` and creates the Gitea release
-  with MCP (notes only; the binaries stay in the registry).
+  the skill verifies that `latest/download/VERSION` serves the new version.
 - `install.sh` (`curl -fsSL …/raw/branch/main/install.sh | sh`) detects
   OS/arch, verifies the sha256, installs `submarine` and a `sub` symlink to
   `~/.local/bin` (`SUBMARINE_INSTALL_DIR`, `SUBMARINE_VERSION`,
@@ -221,7 +228,7 @@ No CI runner: releases are built and published from a developer machine.
 - `submarine update [--check] [--force]` (package `internal/update`) reads
   `VERSION`, downloads the asset for the running platform, verifies the
   checksum and atomically replaces the real executable (symlinks resolved,
-  so `sub` works too). `SUBMARINE_UPDATE_URL` overrides the registry.
+  so `sub` works too). `SUBMARINE_UPDATE_URL` overrides the releases root.
 - On every start the TUI looks for a newer release in the background (3 s
   timeout, no cache, no blocking). `main` passes `tui.WithUpdateCheck` and
   the TUI gets the result as a message; the footer then offers `q quit and

docs/decisions.md

@@ -201,7 +201,8 @@ package so versions stay clean.
 corrupt or partial downloads, not a compromised registry (no signatures).
 The update check is a deliberate, outside-the-provider network use: only
 on `update` and a background check at startup that can be disabled (it
-was once a day; see D27).
+was once a day; see D27). The registry was replaced by GitHub releases in
+D33; local builds, `install.sh` and the pointer file stay.
 
 ## Copy path with `c` via OSC 52
 
@@ -634,3 +635,30 @@ skipped. Contextual palettes that grey out impossible keys: larger, kept for
 later (item 10 of the usability plan).
 **Consequences.** `footer.Keys` drops `help.KeyMap` for `Tools`,
 `HelpGroups` and `LegendKeys`; the footer renders the full help itself.
+
+## D33 — Releases move to GitHub, with one bridge release on Gitea
+
+**Context.** The repository moves from `git.simon-franken.de` (Gitea) to
+`github.com/simonfranken/submarine`. Installed binaries only know the Gitea
+registry (D21), and check it on every start (D27).
+**Decision.**
+- Releases are GitHub releases with the binaries, `checksums.txt` and
+  `VERSION` as assets. GitHub Packages has no generic registry. Clients read
+  `releases/latest/download/VERSION` and `releases/download/<v>/<asset>`:
+  plain redirects, not the API, so the check on every start is not rate
+  limited and needs no token.
+- `make release` creates a draft, uploads all assets, then publishes: the
+  draft takes the role of D21's "pointer last".
+- One bridge version, the first that reads from GitHub, is also published to
+  Gitea in the old layout (`make release-gitea`). Old binaries update to it
+  from Gitea, and from then on update from GitHub. `release-gitea` refuses
+  until GitHub serves the version, so no bridge binary finds GitHub empty.
+- The Gitea registry stays online with the bridge as its latest version, and
+  the Gitea repository is archived, not deleted: a binary started for the
+  first time in months still finds its way over.
+**Alternatives.** Keep Gitea and mirror to GitHub: two places to publish
+to. Have the updater try both hosts: permanent code for a one-time move.
+**Consequences.** `SUBMARINE_UPDATE_URL` and `SUBMARINE_BASE_URL` now take
+a releases root, not a registry root. Versions before the bridge exist only
+on Gitea; `SUBMARINE_VERSION=<old>` with the new `install.sh` doesn't find
+them. `release-gitea` and the Gitea settings go once the bridge is out.